Apache Camel’s CXF and Knative header filters fail to block inbound Camel‑internal headers. Without the required setInFilterStartsWith configuration, an attacker can craft HTTP requests containing headers such as CamelExecCommandExecutable or CamelFileName. The unchecked value is then forwarded to message‑driven components that interpret these headers, enabling arbitrary command execution or file write operations. This flaw is an instance of CWE‑178 due to the absence of proper string length validation when processing incoming header data.

The vulnerability affects Apache Camel versions 3.18.0 through 4.14.5 and 4.15.0 through 4.18.1. The vendor is the Apache Software Foundation. Users running any of these releases are at risk until they apply a patch.

Exploitation requires only a crafted HTTP request to a CXF‑RS or CXF‑SOAP endpoint; no authentication is needed. Although no CVSS score is published and the EPSS score is unavailable, the potential for remote code execution places the risk in the highest severity band. The vulnerability is not listed in the CISA KEV catalog, but the clear attack path and the severity of the impact warrant urgent remediation.